[dependabot]

Bumps claude-agent-sdk from 0.2.110 to 0.2.121.

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.121

Bug Fixes

• Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

• Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
• CI now lints and typechecks scripts/ alongside src/ and tests/
• CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
• Updated bundled Claude CLI to version 2.1.212

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.121/

pip install claude-agent-sdk==0.2.121

v0.2.120

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.211

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.120/

pip install claude-agent-sdk==0.2.120

v0.2.119

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.210

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.119/

pip install claude-agent-sdk==0.2.119
</tr></table> 

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.121

Bug Fixes

• Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

• Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
• CI now lints and typechecks scripts/ alongside src/ and tests/
• CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
• Updated bundled Claude CLI to version 2.1.212

0.2.120

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.211

0.2.119

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.210

0.2.118

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.209

0.2.117

Bug Fixes

• Escaped untrusted fields in Slack issue notification workflow: Fixed the Slack notification workflow to properly escape issue titles and usernames using jq instead of bash substitution, preventing malformed JSON payloads and mrkdwn injection from specially crafted issue titles (#1116)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.208

0.2.116

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.207
• Fixed CI workspace trust so Claude Code honors project-scoped permission grants in checkout directories (#1085)

0.2.115

... (truncated)

Commits

• f604b8c docs: update changelog for v0.2.121
• 0a87d2c chore: release v0.2.121
• 1cd470d chore: bump bundled CLI version to 2.1.212
• 0278287 Validate CLAUDE_CLI_VERSION and remove shell interpolation from the build scr...
• 347a1cb Pass --resume and --session-id as a single argv token (#1123)
• af69c01 docs: update changelog for v0.2.120
• 07f1ab3 chore: release v0.2.120
• 135bf9a chore: bump bundled CLI version to 2.1.211
• 57f67cd docs: update changelog for v0.2.119
• d434722 chore: release v0.2.119
• Additional commits viewable in compare view

---

Note

Overview
Bumps claude-agent-sdk from 0.2.110 to 0.2.121 across the workspace: the launchdarkly-ai-claude-agents runtime pin moves from >=0.2 to >=0.2.121, the root dev group matches that floor, and uv.lock is refreshed to the new wheels/sdist.

Consumers of launchdarkly-ai-claude-agents therefore pick up upstream fixes in 0.2.121—notably argv flag injection hardening for --resume / --session-id (relevant where this repo forwards session_id into the SDK)—plus a newer bundled Claude CLI and build-script hardening in the dependency itself. No application source changes in this repo.

^{Reviewed by Cursor Bugbot for commit 31bd0f9. Bugbot is set up for automated code reviews on this repo. Configure here.}